open-bamboo-networking/research/06.03-ftps.md

6.3. FTPS

Bambu printers expose an implicit-TLS FTP daemon used for file transfer to an external / USB-style volume (and for stock hybrid print staging). It is a separate service from the Device → Files browser on :6000 (§6.4).

When it is used

• LAN / hybrid print uploads that STOR a .gcode.3mf (stock _with_record FTPS leg, older N7-class pure-LAN FTPS, verify_job probes).
• Legacy Send-to-Printer when :6000 / brtc is unavailable.
• Not the stock P2S Device → Files path (that is CTRL on :6000).

Observed P2S FTPS root follows the inserted USB stick; internal eMMC paths are often unreachable over FTPS — layout notes: §9.6.1.1.

Login and TLS

Item	Value
Port	TCP/990, implicit TLS (no AUTH TLS)
User / pass	bblp / access code
Leaf	CN=<serial>; optional anti-MITM check — hub

Dialect quirks (why generic FTP clients fail)

From LAN probes (not Studio source):

• Handshake starts immediately on connect — plaintext clients on 990 hang.
• After 230: mandatory TYPE I → PBSZ 0 → PROT P before data commands.
• PASV only; PORT unsupported. PASV tuple IP is often 0.0.0.0 or unreachable — reconnect data socket to the control host.
• Delayed data-channel TLS: TCP-connect data port → send STOR/LIST → wait for 150 → then TLS on data → transfer → 226. Handshaking TLS right after TCP connect hangs.
• No MLSD (use LIST); NLST unreliable; no resume (REST/APPE); idle ~5 min silent drop; no command pipelining.

Full quirk list historically lived next to the CTRL docs; the list above is the operational summary. Practical plaintext↔FTPS bridge: tools/bambu_ftp_proxy.py.

Typical payload

Binary STOR of print-ready .gcode.3mf (and small probe files). Print-start URL schemes that refer to FTPS volume use ftp://… — §8.8.1, §8.8.3.

Community quirk index: H2 :990 external-only #2762, P2S probe 550 #1170, MakerWorld subtask_name #2931 — see §16. Community quirk index.

Hub: §6.